Platform ingress-nginx uses default client-header buffers — large OIDC tokens cause HTTP 400 #2853

Describe the bug

When OIDC is enabled and Keycloak is configured with an external IdP and users group list is large, the resulting access token may get too large to pass the default limits of nginx client header buffers resulting in 400 Bad Request: request header or cookie too large.

Environment

• Cozystack version: 1.3.5
• Provider: on-prem

To Reproduce

Steps to reproduce the behavior:

1. Configure cozystack with oidc and keycloak and a user with a large amount of groups.
2. Authenticate in dashboard.
3. Once authenticated and redirected, see the error (depicted on the screenshot)

Expected behaviour

Users having large access token cookies be able to login and use the dashboard.

Actual behaviour

Users are unable to use the dashboard.

Logs

root-ingress-controller-675b5fb44d-npg49 controller 127.0.0.1 - - [08/Jun/2026:16:54:56 +0000] "GET /openapi-ui/default/api-table/core.cozystack.io/v1alpha1/tenantnamespaces HTTP/1.1" 400 635 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" 9443 0.005 [cozy-dashboard-incloud-web-gatekeeper-8000] [] 172.20.6.136:8000 635 0.004 400 3f19b3fc052bfd167ed31d33881b6c0e
root-ingress-controller-675b5fb44d-npg49 controller 127.0.0.1 - - [08/Jun/2026:16:54:56 +0000] "GET /favicon.ico HTTP/1.1" 400 635 "https://dashboard.<redacted>/openapi-ui/default/api-table/core.cozystack.io/v1alpha1/tenantnamespaces" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" 9351 0.004 [cozy-dashboard-incloud-web-gatekeeper-8000] [] 172.20.6.136:8000 635 0.004 400 3e0d8745789f01ed9223c1cb0b9043a0
root-ingress-controller-675b5fb44d-npg49 controller 127.0.0.1 - - [08/Jun/2026:16:54:56 +0000] "GET /openapi-ui/default/api-table/core.cozystack.io/v1alpha1/tenantnamespaces HTTP/1.1" 400 635 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" 9443 0.004 [cozy-dashboard-incloud-web-gatekeeper-8000] [] 172.20.6.136:8000 635 0.003 400 5d08426ea297959b9840b32053ea20f7

Screenshots

Additional context

To fix the problem, the tenant-root ingress nginx controller configmap requires a new configuration parameter client-header-buffer-size: 16k. The incloud-web-nginx-config configmap in cozy-dashboard also requires to be patched (under the server context) with client_header_buffer_size 16k;.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs

Maintainer note — scope

Scoping this issue to the platform ingress-nginx controller. Confirmed on the current default branch: the ingress-nginx controller config does not raise client-header-buffer-size / large-client-header-buffers (packages/system/ingress-nginx/values.yaml leaves the controller config empty), so a large OIDC cookie exceeds the nginx defaults and the controller returns 400 request header or cookie too large. The dashboard ingress (packages/system/dashboard/templates/ingress.yaml) only sets proxy-buffer-size (upstream-response buffers), which does not cover the client request-header path.

The console image's own nginx — the /etc/nginx/conf.d/default.conf baked into the cozystack-ui Containerfile — is the second layer carrying the same oversized headers, tracked separately in #3113. Both layers need the larger buffers for the fix to be complete.